GHSA-86qj-4h55-fvpw

Suggest an improvement
Source
https://github.com/advisories/GHSA-86qj-4h55-fvpw
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-86qj-4h55-fvpw/GHSA-86qj-4h55-fvpw.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-86qj-4h55-fvpw
Aliases
Published
2022-05-14T04:01:58Z
Modified
2026-07-07T11:56:28Z
Summary
OpenStack Heat template URL information leakage
Details

OpenStack Orchestration API (Heat) 2013.2 through 2013.2.3 and 2014.1, when creating the stack for a template using a provider template, allows remote authenticated users to obtain the provider template URL via the resource-type-list.

Database specific 
{
    "cwe_ids":  [
        "CWE-200"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2023-12-07T21:47:18Z",
    "nvd_published_at":  "2014-05-23T14:55:00Z",
    "severity":  "LOW"
}
References

Affected packages

PyPI / openstack-heat

Package

Name
openstack-heat
View open source insights on deps.dev
Purl
pkg:pypi/openstack-heat

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.0.0a0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-86qj-4h55-fvpw/GHSA-86qj-4h55-fvpw.json"